CVE-2026-98233 - Vulnerability Details

- net/packet: clear RX owner on VNET header error

Description

In the Linux kernel, the following vulnerability has been resolved:

net/packet: clear RX owner on VNET header error

Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race
condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2
ring slot before converting the virtio-net header. If the conversion
fails, the drop path leaves the slot claimed.

With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves
the only slot unavailable, so the ring also drops the next valid packet.

Clear the ownership bit on this error path. TPACKET_V3 already clears
its block state here.

Published: 2026-10-06

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< bb10a0084c03a94364aeec542beddc5d49b59f59
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< b8c0cb3069058c2d67b5c7c833b2833381ecffdc
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< 2daa618e7ff19eefcbda281bc4c5998c4140f9cf
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< 23cd30498891d29a69ec9b75bd92f8a0f21f1342
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< 49a48a5aaf85fe69d2dc3fb334b4854fadf44e39
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< 805edbdcb8681da5f7ee43b3c3c809f7a8c31208
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< 693209a237fc548791cf402441db8b68d1da7d38
`61fad6816fc10fb8793a925d5c1256d1c3db0cd2`	affected	< 33ff111d7ba3beb86e28938d6382bb5beabd865a
`2975472e042e0bbfeeabddc5023cb8c011ec5a07`	affected	—
`6fb0e4385928900ccb8697748555b3f54bba5193`	affected	—
`86137342fd4cf52882842aa8d1318b2661f08e8a`	affected	—
`b06e4d3ed4044c2facf10a511d809f9aa29d960e`	affected	—
`4.14.175`	affected	< 4.15
`4.19.114`	affected	< 4.20
`5.4.29`	affected	< 5.5
`5.5.14`	affected	< 5.6

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3-rc4`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,bb10a0084c03a94364aeec542beddc5d49b59f59)`	affected	code_commit	—
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,b8c0cb3069058c2d67b5c7c833b2833381ecffdc)`	affected	code_commit	—
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,2daa618e7ff19eefcbda281bc4c5998c4140f9cf)`	affected	code_commit	—
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,23cd30498891d29a69ec9b75bd92f8a0f21f1342)`	affected	code_commit	—
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,49a48a5aaf85fe69d2dc3fb334b4854fadf44e39)`	affected	code_commit	—
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,805edbdcb8681da5f7ee43b3c3c809f7a8c31208)`	affected	code_commit	—
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,693209a237fc548791cf402441db8b68d1da7d38)`	affected	code_commit	—
`[61fad6816fc10fb8793a925d5c1256d1c3db0cd2,33ff111d7ba3beb86e28938d6382bb5beabd865a)`	affected	code_commit	—
`2975472e042e0bbfeeabddc5023cb8c011ec5a07`	affected	code_commit	—
`6fb0e4385928900ccb8697748555b3f54bba5193`	affected	code_commit	—
`86137342fd4cf52882842aa8d1318b2661f08e8a`	affected	code_commit	—
`b06e4d3ed4044c2facf10a511d809f9aa29d960e`	affected	code_commit	—
`[4.14.175,4.15)`	affected	semver	—
`[4.19.114,4.20)`	affected	semver	—
`[5.4.29,5.5)`	affected	semver	—
`[5.5.14,5.6)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	semver	—
`[0,5.6)`	unaffected	semver	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98233.mbox
https://git.kernel.org/stable/c/23cd30498891d29a69ec9b75bd92f8a0f21f1342
https://git.kernel.org/stable/c/2daa618e7ff19eefcbda281bc4c5998c4140f9cf
https://git.kernel.org/stable/c/33ff111d7ba3beb86e28938d6382bb5beabd865a
https://git.kernel.org/stable/c/49a48a5aaf85fe69d2dc3fb334b4854fadf44e39
https://git.kernel.org/stable/c/693209a237fc548791cf402441db8b68d1da7d38
https://git.kernel.org/stable/c/805edbdcb8681da5f7ee43b3c3c809f7a8c31208
https://git.kernel.org/stable/c/b8c0cb3069058c2d67b5c7c833b2833381ecffdc
https://git.kernel.org/stable/c/bb10a0084c03a94364aeec542beddc5d49b59f59
https://nvd.nist.gov/vuln/detail/CVE-2026-98233
https://www.cve.org/CVERecord?id=CVE-2026-98233

History

Sat, 10 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98233.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98233 https://www.cve.org/CVERecord?id=CVE-2026-98233
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Tue, 06 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed. With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet. Clear the ownership bit on this error path. TPACKET_V3 already clears its block state here.
Title		net/packet: clear RX owner on VNET header error
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/23cd30498891d29a69ec9b75bd92f8a0f21f1342 https://git.kernel.org/stable/c/2daa618e7ff19eefcbda281bc4c5998c4140f9cf https://git.kernel.org/stable/c/33ff111d7ba3beb86e28938d6382bb5beabd865a https://git.kernel.org/stable/c/49a48a5aaf85fe69d2dc3fb334b4854fadf44e39 https://git.kernel.org/stable/c/693209a237fc548791cf402441db8b68d1da7d38 https://git.kernel.org/stable/c/805edbdcb8681da5f7ee43b3c3c809f7a8c31208 https://git.kernel.org/stable/c/b8c0cb3069058c2d67b5c7c833b2833381ecffdc https://git.kernel.org/stable/c/bb10a0084c03a94364aeec542beddc5d49b59f59

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:45:06.533Z

Updated: 2026-10-06T08:45:06.533Z

Reserved: 2026-09-25T10:25:14.328Z

Link: CVE-2026-98233

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:10.857

Modified: 2026-10-06T09:18:10.857

Link: CVE-2026-98233

Redhat

Severity : Low

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98233 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-10T01:45:15Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-772
Missing Release of Resource after Effective Lifetime

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object